
Research
/Security News
Mini Shai-Hulud Campaign Hits Red Hat Cloud Services npm Packages
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.
@o3r/dev-tools
Advanced tools
Various CLI scripts to help your CI/CD process and your dependency management
Various CLI scripts to help your CI/CD and your dependency management
[!CAUTION] Deprecated package
@o3r/dev-toolspackage is deprecated and will no longer be updated as of Otter v12. The following CLI scripts have been moved to other otter packages:
artifact-cleaner: please useo3r-artifact-cleanerfrom the package@o3r/artifactory-toolspr-artifact-cleaner: please useo3r-pr-artifact-cleanerfrom the package@o3r/artifactory-toolscomment-pr: please useo3r-comment-prfrom the package@o3r/azure-toolsversion-harmonize: replaced by the JSON ESLint rule @o3r/json-dependency-versions-harmonize
This package can be used via npx command to executed on of the listed command line interfaces.
npx -p @o3r/dev-tools ...
:warning: Deprecate: This script is deprecated and will be removed in Otter v12.
Gets an artifact from the ArtiFactory
Usage: artifact-retriever [options]
Get an artifact from Artifactory, artifact-group, artifact-name and artifact-version are mandatory
Options:
--registry <url> Registry URL. It is ignored for Azure Artifacts.
--repository-manager <manager> Artifact repository manager. Supported managers are JFrog, Azure Artifacts (default: JFrog)
--organization <organization> Azure Artifacts organization
--project <project> Azure Artifacts project
--feed <feed> Azure Artifacts feed
-a, --artifact-name <version> Artifact name
-v, --artifact-version <version> Artifact version
-g, --artifact-group <group> Artifact group name
-r, --artifact-repos <repositories> Artifact repositories (default: )
-u, --username <username> Artifactory username (default from ARTIFACTORY_USERNAME)
-p, --password <password> Artifactory user password (default from ARTIFACTORY_PASSWORD)
-o, --out <path> Output file name (default: ./built/${name}.jar)
--use-package-version Use the package version as artifact version
-h, --help output usage information
[!TIP] password and username options can be provided via Environment variables.
artifact-retriever.js --registry "https://jfrog.io/repoName" -u <username> -p <password> -v "1.0.0" -g "io.swagger" -a "typescriptFetch-swagger-codegen" --out /path/to/typescriptFetch-swagger-codegen.jar
artifact-retriever.js --repository-manager "Azure Artifacts" --organization "AmadeusDigitalAirline" --project "Otter" --feed "otter" -u <username> -p <password> -v "1.0.0" -g "io.swagger" -a "typescriptFetch-swagger-codegen" --out /path/to/typescriptFetch-swagger-codegen.jar
:warning: Deprecate: This script is deprecated and will be removed in Otter v12.
Replaces the value of the version field of the package.json matched by the pattern provided to the --include options.
Usage: set-version [options] <version>
Replace the packages version in a monorepos
Options:
-p, --placeholder <placeholder> Pattern of the version placeholder (default: 0.0.0)
--include <file> Add files pattern to apply the verison replacement (default: */lerna.json,**/package.json,!**/node_modules/**/{package,lerna}.json)
-h, --help output usage information
:warning: Deprecate: This script is deprecated, please use
o3r-artifact-cleanerfrom the package@o3r/artifactory-tools
Cleans old artifacts from artifactory repositories
Usage: artifact-cleaner -b <Base 64 encoding of username:password (password already encrypted from artifactory UI)> [options]
Clean old artifacts from artifactory repositories, base 64 encoding of username:password is mandatory
Options:
--artifactory-url <artifactoryUrl> Artifact URL (Required)
-a, --duration-kept <durationKept> All the artifact which have been created since more time than this value(ms) will be deleted (Default to 10080000ms (i.e. 7 days))
-r, --repositories <repositories> Artifact repositories to clean up (coma separated) ex : npm-otter-pr,npm-o3r-pr (Default to npm-otter-pr)
-t, --type-filter <typeFilter> List of artifact type that should be deleted coma separated (ex: jar,tgz) (Default : tgz)
--dry-run <dryRun> List all files that should be deleted without actually deleting them. (Default to false)
-h, --help Output usage information
Example : yarn artifact-cleaner -b thisismybase64tokenwithuserandencryptedpassword
:warning: Deprecate: This is deprecated, please use
o3r-pr-artifact-cleanerfrom the package@o3r/artifactory-tools
Cleans old PR artifacts by identifying using the the build version that is present in the path. If build version is not present in the path this tool cannot yet be used.
Usage: pr-artifact-cleaner -b <Base 64 encoding of username:password (password already encrypted from artifactory UI)> [options]
Clean old artifacts from artifactory repositories, base 64 encoding of username:password is mandatory
Options:
-u, --artifactory-url <artifactoryUrl> Artifact URL
-d, --duration-kept <durationKept> Only artifacts which are older than this value (in days) will be deleted. (Default to 1 day)
-r, --repository <repository> Artifact repository to clean up. (Default to dga-maven-built-adt-nce)
-pr, --pr-versions <prVersions> Number of pr versions that will be kept. (Default to 2 last versions)
--dry-run <dryRun> List all files that should be deleted without actually deleting them. (Default to false)
-p, --path <path> Artifact paths to cleanup use matcher from AQL language. Be careful that the path do not include release artifacts (Default to com/amadeus/retailing/*-PR-*)
-h, --help Output usage information
Example : yarn pr-artifact-cleaner -b thisismybase64tokenwithuserandencryptedpassword
:warning: Deprecate: This script is deprecated and will be removed in Otter v12.
Updates a package.json with the given dependencies' versions and their respective peer dependencies.
Relies on npm info to retrieve package information.
Usage: peer-dependencies-updater <package@version> [other packages]
Update the given packages version and their peer dependencies range in the provided package.json file (defaulted to local ./package.json)
Options:
-p, --package-json <packageJson> Path to the package.json file to update. Default: ./package.json
--verbose Display debug log message
--silent Do not exit with error in case of metadata fetch error
Example : peer-dependencies-updater "@random/package@~2.21.0" "@o3r/core"
:warning: Deprecate: This script is deprecated and will be removed in Otter v12, it is replaced by the JSON ESLint rule @o3r/json-dependency-versions-harmonize.
Replaces the dependencies' version in a monorepos. This align the dependencies' range of each package of a yarn monorepo to the latest range detected in the monorepo.
Usage: version-harmonize [options]
Replace the dependencies version in a monorepos
Options:
-m, --monorepo <package> Path to the private package.json of the monorepo (default: "<process.cwd()>")
-t, --dependencyTypes <...types> List of dependency types to update, comma separated (default: ["optionalDependencies","dependencies","devDependencies","peerDependencies","generatorDependencies"])
-v, --verbose Display debug logs
-a, --alignPeerDependencies Enforce to align the version of the dependencies with the latest range
-h, --help display help for command
The version-harmonize command is reading the content of the package.json file to get the following options:
The configuration can be provided in the package.json file as follows:
{
"name": "@o3r/my-package",
"otter": {
"versionHarmonize": {
"ignore": [
"typescript",
"webpack"
]
}
}
}
:warning: Deprecate: This script is deprecated and will be removed in Otter v12.
Edits the generated package.json file to add the exports of the packages based on defined sub-entries.
The sub-entries should be specified as JSON files (package.json per default) in the folder to expose.
Usage: generate-package-exports [options]
Update package.json exports
Options:
--cwd <path> Path to the root of the project (default: "<process.cwd()>")
-o, --outDir <path> Path to folder containing the package.json to edit (default: "./dist")
-s, --srcDir <path> Path to source folder containing the source code (default: "./src")
-p, --pattern <packages> Pattern of the JSON filenames to read to determine sub entries (default: "package.json")
--export-types <...types> Add additional supported export types (default: ["typings","types","node","module","es2015","es2020","esm2015","esm2020","esm","default","require","import"])
-v, --verbose Display debug logs
-h, --help display help for command
FAQs
Various CLI scripts to help your CI/CD process and your dependency management
The npm package @o3r/dev-tools receives a total of 2,889 weekly downloads. As such, @o3r/dev-tools popularity was classified as popular.
We found that @o3r/dev-tools demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.

Research
/Security News
The North Korean malware loader hides in a Packagist-listed package and its GitHub branch to fetch and execute remote code in a likely Contagious Interview-style lure.

Security News
The Rust project is moving toward formal rules on LLM use in contributions after months of internal debate over maintainer burden, code quality, and contributor experience.